ClawHub
Back to skill

Security audit

Ztm Tunnel

Security checks for vulnerabilities and agentic risk

Overview

This tunnel-management skill is mostly coherent, but its installer and examples create enough system and network-exposure risk that users should review it before installing.

Before installing, review install.sh carefully. Prefer installing ZTM through a trusted package path or a pinned, verified release, avoid sudo unless you intentionally want a system-wide binary, and bind tunnel listeners to 127.0.0.1 or a specific trusted interface unless you deliberately intend to expose the service to other hosts.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Error
Location
install.sh:50
Finding

Unverified and Unpinned Remote Executable Installation

Content
View full analysis
/dev/null; then # Extract tar -xzf "$FILENAME" # Install to /usr/local/bin (requires sudo) if [[ -w /usr/local/bin ]]; then mv bin/ztm /usr/local/bin/ztm chmod +x /usr/local/bin/ztm else echo -e "${YELLOW} Note: Need sudo to install to /usr/local/bin${NC}" sudo mv bin/ztm /usr/local/bin/ztm sudo chmod +x /usr/local/bin/ztm fi echo -e "${GREEN}✅ ZTM installed successfully!${NC}" else echo -e "${RED}❌ Failed to download ZTM${NC}" exit 1 fi # Cleanup cd / rm -rf "$TEMP_DIR" fi # Verify installation echo -e "${YELLOW}🔍 Step 2: Verifying ZTM...${NC}" ztm version ``` ### Technical Analysis The installer obtains the current release identifier dynamically from the GitHub API and downloads the corresponding archive. It does not pin an audited version or verify the archive using a trusted cryptographic signature or expected digest. After the download, the archive is extracted and its `ztm` executable is moved into `/usr/local/bin`. The installed executable is then invoked through `ztm version`, followed later by other `ztm` commands. Consequently, the effective code ...[truncated 1865 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (16)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The stated purpose is tunnel management, but the content also includes software acquisition, agent startup, app installation, and persistent configuration guidance. This behavior expansion is dangerous because users or agents may consent to a networking task while unintentionally performing installation, service management, and local system changes with broader security consequences.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · install.sh (reported line 75)May include surrounding context.

sh
# Install to /usr/local/bin (requires sudo)
        if [[ -w /usr/local/bin ]]; then
            mv bin/ztm /usr/local/bin/ztm
            chmod +x /usr/local/bin/ztm
        else
            echo -e "${YELLOW}   Note: Need sudo to install to /usr/local/bin${NC}"
            sudo mv bin/ztm /usr/local/bin/ztm

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 3)May include surrounding context.

md
# ZTM Tunnel Skills

> Create and manage TCP/UDP tunnels through ZTM's P2P mesh network.

OpenClaw Skill for managing TCP/UDP tunnels via ZTM (Zero Trust Mesh).

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README explicitly instructs users to expose services and bind listeners to 0.0.0.0, which can make the forwarded service reachable on all network interfaces. Even though the feature is legitimate for a tunnel-management skill, the lack of warnings about network exposure, authentication, and least-privilege binding creates a real risk of unintentionally publishing sensitive internal services.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill clearly instructs use of shell commands (ztm, curl) but does not declare any tool scope or permission boundaries. That omission increases the chance an agent executes network-facing and system-modifying actions without explicit user review, which is a real security issue for an operational skill.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: ztm-tunnel
description: "Create and manage TCP/UDP tunnels between ZTM network endpoints. Use this to establish secure P2P port forwarding through the ZTM mesh network."
metadata:
  {
    "openclaw":

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The examples repeatedly bind listeners to 0.0.0.0 and expose services such as SSH, web, and DNS without warning about public reachability, authentication, or firewall implications. In context, this skill is specifically about port forwarding, so unsafe-by-default examples materially increase the risk of unintended external exposure of internal services.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.

Check if ZTM agent is running:

bash
curl http://localhost:7777/api/status

Check mesh status:

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

The script reaches out to api.github.com to dynamically determine the latest release version, creating an external dependency at install time. In combination with the later privileged install path, this network retrieval is security-relevant because it influences which binary gets fetched and executed, and it reduces reproducibility and reviewability of the installed version.

Content

Scanner excerpt · install.sh (reported line 53)May include surrounding context.

sh
cd "$TEMP_DIR"
    
    # Get latest version from GitHub
    LATEST_VERSION=$(curl -s https://api.github.com/repos/flomesh-io/ztm/releases/latest | grep -o '"tag_name":.*' | cut -d'"' -f4)
    
    if [[ -z "$LATEST_VERSION" ]]; then
        echo -e "${RED}❌ Could not get latest ZTM version${NC}"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script downloads a release artifact from the internet and installs it into /usr/local/bin, invoking sudo when needed, without explicit confirmation and without validating the artifact via checksum or signature. In an agent skill context this is risky because it causes privileged system modification and turns any compromise of the download source, release selection, or network path into code execution on the host.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
93% confidence
Finding

This line invokes sudo to move a downloaded binary into /usr/local/bin, elevating privileges for code obtained from the network. If the artifact is malicious or tampered with, the installer grants it a trusted system location and creates a high-impact path to persistent execution.

Content

Scanner excerpt · install.sh (reported line 77)May include surrounding context.

sh
mv bin/ztm /usr/local/bin/ztm
            chmod +x /usr/local/bin/ztm
        else
            echo -e "${YELLOW}   Note: Need sudo to install to /usr/local/bin${NC}"
            sudo mv bin/ztm /usr/local/bin/ztm
            sudo chmod +x /usr/local/bin/ztm
        fi

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
93% confidence
Finding

This line invokes sudo to move a downloaded binary into /usr/local/bin, elevating privileges for code obtained from the network. If the artifact is malicious or tampered with, the installer grants it a trusted system location and creates a high-impact path to persistent execution.

Content

Scanner excerpt · install.sh (reported line 77)May include surrounding context.

sh
mv bin/ztm /usr/local/bin/ztm
            chmod +x /usr/local/bin/ztm
        else
            echo -e "${YELLOW}   Note: Need sudo to install to /usr/local/bin${NC}"
            sudo mv bin/ztm /usr/local/bin/ztm
            sudo chmod +x /usr/local/bin/ztm
        fi

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
91% confidence
Finding

This line uses sudo to mark the installed binary executable in a privileged path, completing the privileged installation of a network-downloaded program. The danger is not the chmod itself but that elevated privilege is being applied to software that was not authenticated, increasing the blast radius of a supply-chain compromise.

Content

Scanner excerpt · install.sh (reported line 78)May include surrounding context.

sh
chmod +x /usr/local/bin/ztm
        else
            echo -e "${YELLOW}   Note: Need sudo to install to /usr/local/bin${NC}"
            sudo mv bin/ztm /usr/local/bin/ztm
            sudo chmod +x /usr/local/bin/ztm
        fi

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · install.sh (reported line 79)May include surrounding context.

sh
else
            echo -e "${YELLOW}   Note: Need sudo to install to /usr/local/bin${NC}"
            sudo mv bin/ztm /usr/local/bin/ztm
            sudo chmod +x /usr/local/bin/ztm
        fi
        
        echo -e "${GREEN}✅ ZTM installed successfully!${NC}"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The script starts a background ZTM agent automatically if the local status check fails, without clearly warning the user that a persistent network-facing service will be launched. In a tunneling skill this is especially sensitive because the service enables mesh networking and port forwarding behavior that can expose local resources or maintain ongoing connectivity beyond the installation step.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The installer creates a persistent configuration file in the user's home directory without prior notice or consent. While the file contents are minimal, silently writing persistent state can surprise users and may affect later tool behavior or trust assumptions for future commands.

Content

No source excerpt is available for this finding.